Mail sent from external address to mailing list gets FORGED_RECIPIENTS spam classification

[80KiloMett]

Hi,
I have created a test mailing list and added some members. When I send a mail from an external address to my list address, the mail is classified as FORGED_RECIPIENTS. This sometimes drives messages over the spam threshold. Is there a way to prevent this other than just lowering the score for FORGED_RECIPIENTS. I'm also not sure why this header would be added in the first place.

The authentication backend is ldap with authentik. Dunno if this might cause issues when checking if a paritcular user is part of a mailing list.

Here's an example header:

Received: from mout02.external.domain (mout02.external.domain [XXX.XXX.XXX.XXX]])
	(using TLSv1.3 with cipher TLS13_AES_256_GCM_SHA384)
	by mail.my.domain (Stalwart SMTP) with ESMTPS id FFFFFFFFFFFFFFF;
	Thu, 12 Dec 2024 14:28:19 +0000
Authentication-Results: mail.my.domain;
	dkim=pass header.d=external.domain header.s=2017 header.b=PBXCL/nB;
	spf=none (mail.my.domain: no SPF records found for postmaster@mout02.external.domain) smtp.helo=mout02.external.domain;
	spf=pass (mail.my.domain: domain of me@external.domain designates XXX.XXX.XXX.XXX as permitted sender) smtp.mailfrom=me@external.domain;
	iprev=pass policy.iprev=XXX.XXX.XXX.XXX;
	dmarc=pass header.from=external.domain policy.dmarc=none
Received-SPF: pass (mail.my.domain: domain of me@external.domain designates XXX.XXX.XXX.XXX as permitted sender)
	receiver=mail.my.domain; client-ip=XXX.XXX.XXX.XXX; envelope-from="me@external.domain"; helo=mout02.external.domain;
X-Spam-Status: Yes, score=6.918844417214807
X-Spam-Result: PREVIOUSLY_DELIVERED (0),
	FORGED_RECIPIENTS (2),
	TO_DN_NONE (0),
	FORGED_RCVD_TRAIL (1),
	PYZOR (3.5),
	SPF_ALLOW (-0.2),
	DWL_DNSWL_BLOCKED (0),
	DNSWL_BLOCKED (0),
	URIBL_BLOCKED (0),
	RCVD_TLS_LAST (0),
	RCPT_COUNT_ONE (0),
	ARC_NA (0),
	DKIM_SIGNED (0),
	FROM_HAS_DN (0),
	RWL_MAILSPIKE_GOOD (-0.1),
	FROM_EQ_ENVFROM (0),
	DKIM_ALLOW (-0.2),
	RCVD_COUNT_TWO (0),
	MID_RHS_MATCH_FROM (1),
	DMARC_POLICY_ALLOW (-0.5),
	RBL_SENDERSCORE (2)
Return-Path: <me@external.domain>
Received: from submission (external.domain [XXX.XXX.XXX.YYY]) 
	by mout02.external.domain (Postfix) with ESMTPS id FFFFFFFFFFF
	for <list@my.domain>; Thu, 12 Dec 2024 15:28:18 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=external.domain; s=2017;
	t=1734013698; bh=n/1x4m33lOQFFdAM3FKsgr9drcwdho1LdArC8/f0Q+Q=;
	h=Date:From:To:Subject:Message-ID:MIME-Version:Content-Type:
	 Content-Transfer-Encoding:From;
	b=PBXCL/nB3ljTp0oqNxGUpM5AIqE8+p6IvlF0sixnE2QdIlu2zgQB9E+zGeqa/Y2Fg
	 F7dlCDPVF0iWhP37BPDABVJGMqaVVtUEi+cwsnHHsdwHqo6ji4AUFfaQi0pXrpUx5e
	 iGP2fipysq4cOKw1DhjynWtoAL0/8VfmLmoTC3TM/WBCNgeeY852t+9BWX3aCWePwB
	 HcF5HNfWmwkSusFlqbzD6sgnn081hTLf1d/XCef12K61CCi2pAqatciKvGOzG4QX+m
	 eym01OZsUDl5vbOprY1rSnywNpCLo0F9MSYl/zzbdhzt8RMPUxLTZdc6fqfgI/D1Wa
	 tjzYE6a5G24mg==
Received: from customer (localhost [127.0.0.1])
	by submission (external.domain) with ESMTPSA id XXXXXXXXXXXXXX
	for <list@my.domain>; Thu, 12 Dec 2024 15:28:18 +0100 (CET)
Date: Thu, 12 Dec 2024 14:28:19 +0000
From: 80KiloMett <me@external.domain>
To: list@my.domain
Subject: bla
Message-ID: <D8B4B876-4DCB-478A-9E3B-1A5C74E8BCEB@external.domain>
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary=----ORZK6XZGMC4B9KVAXL4VC3984TU3N7
Content-Transfer-Encoding: 7bit

[mdecimus]

Hi, can you paste here the original headers of the message?

[80KiloMett]

Edited original post.

[mdecimus]

The FORGED_RECIPIENTS is being assigned because the header does not include List-Id or List-Unsubscribe headers and, most importantly, because the recipients provided in the envelope to (provided during the SMTP transaction) do not seem to match the recipients in the To header.

[80KiloMett]

most importantly, because the recipients provided in the envelope to (provided during the SMTP transaction) do not seem to match the recipients in the To header.

That part is what I figured as well. My problem with this behavior right now is that I would like to use the list feature as a sort of initial point of contact. I want to have an address that people can write to where all messages get relayed to the relevant people, in which case it is expected that the final recipient is not the same as the list address. Is there any way to realize that without driving mails over the spam threshold? Is there something that I can/should configure to not trigger FORGED_RECIPIENTS. Is there a better way of doing this other than the mailling list feature? As I said on my side the list is intended to receive mails from outside my instance and from people that are not subscribed to the list.

[mdecimus]

You can lower the score of the FORGED_RECIPIENTS tag if you like.